NC Office unaccessible behind cloudflare tunnel with cloudflare-based access controll

[marcusfey]

I'm using cloudflare tunnel with access control. This makes a cloudflare login-form appear before accessing the configured "backend applications. I love this because I feel I have to care a bit less about security since I'm offloading this all to cloudflare (which again optionally offloads the identity check to Google, MS, GH, ...).

The problem is: this breaks my Nextcloud Office setup.

I can still use NC through the website, change configs, access files and directories, ... But once I try to open an Office document this fails with "Loading of the document failed"/"Socket connection could not be established or socket connection was unexpectedly closed" (translated from German).

If I deactivate the cloudflare access restriction everything works without any modifications of NC's config.

Cloudflare config:

Nextcloud office config shown as valid without cloudflare access control:

...this turns red if I activate cloudflare access.

docker logs nextcloud-aio-collaborashows:

[ remotefontconfig_poll ] ERR  Remote config server has response status code: 302 (Found)| wsd/COOLWSD.cpp:1306

Can this work at all? What would I have to do?

[szaimen]

Hi, see https://github.com/nextcloud/all-in-one?tab=readme-ov-file#notes-on-cloudflare-proxytunnel

[marcusfey]

Thanks for your response!

I don't really believe this is the answer for several reasons:

• When I turn off cloudflares authentication, I am able to edit files using collabora, thus nextcloud and collabora seem to like each other basically
• I already added 0.0.0.0/0 to the wopi-allowlist
• My understanding is that nextcloud and collabora talk to each other through HTTP at the adress configures under "Verwende deinen eigenen Server". This address is protected by cloudflare's authentication (normally I would have to log in using email based OTP or some IDP). The 302 in the log are probably cloudflare redirecting nextcloud to cloudflares login form.

It would be great to know if my understanding is correct and if there is any way at all that my goal can be reached.

[szaimen]

Collabora and Nextcloud should talk to each other using the chosen Nextcloud domain via https.

[cybrnook]

@marcusfey wondering if you ever got this working? I also would like to use an authentication page in front of a cloud flare tunnel and I made it as far as you did and see the same things. With the auth page I can use the base features of nextcloud seemingly okay, but the domain check portion of Collabora Office fails internally and I cannot open/edit files. When I disable the auth page, Collabora works, but I lose that extra layer of security.